GHSA-h6rp-8v4j-hwph

Apache Camel's XSLT component allows remote attackers to execute arbitrary Java methods

Source: GitHub Advisory Database (reviewed) High CVE-2014-0003

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.camel:camel-core	>= 2.11.0, < 2.11.4	2.11.4
Maven	org.apache.camel:camel-core	>= 2.12.0, < 2.12.3	2.12.3

Details

As written in the advisory (Markdown source, shown as plain text).

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-0003 advisory
https://github.com/apache/camel/commit/483b445dc77487e2d0f3d8c8bf1a7bbab04464c web
https://github.com/apache/camel/commit/c6de749e9b3c7b61861c5480e91550290585224 web
https://github.com/apache/camel/commit/e922f89290f236f3107039de61af0375826bd96d web
https://github.com/apache/camel package
https://issues.apache.org/jira/browse/CAMEL-7123 web
https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E web
https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E web
https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E web
https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E web
https://web.archive.org/web/20200229061309/http://www.securityfocus.com/bid/65902 web
http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc web
http://rhn.redhat.com/errata/RHSA-2014-0245.html web
http://rhn.redhat.com/errata/RHSA-2014-0254.html web
http://rhn.redhat.com/errata/RHSA-2014-0371.html web
http://rhn.redhat.com/errata/RHSA-2014-0372.html web